Comment by HenriTEL
7 days ago
It turns out that most people don't want the need to re-generate each of their credentials when they lose their device.
7 days ago
It turns out that most people don't want the need to re-generate each of their credentials when they lose their device.
Why would they need to re-generate? Pretty much all websites are using copyable passkeys. The user just needs log in to their password manager on their new device. Which for most people just means logging in to their Apple or Google account. There is virtually no difference to storing generated passwords in a password manager or storing passkeys.
And the sad truth is: Most people have no password manager at all. They are used to re-generate new passwords every time they want to log in! I'd wager that on some websites the vast majority of people are loggin in by pressing "I forgot my password".
AFAIK the whole point of attested passkeys is that they are not copyable, which make it pointless to backup in apple cloud, which must be one of the main reason Apple decided to not go that route.
Backup and syncing has indeed been mentioned many times as a factor by Apple why they don't think supporting attestation for consumers makes sense. Consumers need easy/automatic backup and syncing for these keys to be used at all in the consumer world by non-technical users. It is the "it just works" of Passkey management.
Apple has also made it clear they have privacy concerns about attestation as well, which is also why they don't support it, but backup and syncing are clearly very important to Apple because that is very important to keeping consumers happy.